Detecting abuse elevation control mechanism (T1548)

What is abuse elevation control mechanism (T1548)?

MITRE ATT&CK® Abuse Elevation Control Mechanism (T1548) describes a set of privilege escalation techniques where adversaries exploit or circumvent operating system elevation controls, rather than exploiting a software vulnerability, to gain higher-privilege access. Unlike Exploitation for Privilege Escalation (T1068), which requires a vulnerable target, T1548 abuses the elevation mechanism itself.

On Windows, the primary sub-technique is Bypass User Account Control (T1548.002), where attackers exploit the UAC auto-elevation behavior in trusted system processes to silently escalate from medium-integrity (standard user) to high-integrity (administrator) context. In cloud environments, Temporary Elevated Cloud Access (T1548.005) abuses IAM role assumption mechanisms to obtain administrator-level API access.

T1548 Sub-Techniques

T1548 encompasses six sub-techniques across Windows, Linux, macOS, and cloud platforms. Log360 detection coverage is strongest for Windows (T1548.002) and cloud (T1548.005):

How Attackers Use T1548

T1548 attacks vary by sub-technique, but follow a consistent pattern of abusing a legitimate elevation control rather than exploiting a software bug:

1. Identify the bypass vector: The attacker enumerates available auto-elevating processes (Windows), sudo misconfigurations (Linux), or IAM role policies with assumable permissions (cloud). Tools like SharpHound, WinPEAS, LinPEAS, and Pacu (AWS) automate this reconnaissance phase.
2. Stage the bypass payload: For UAC bypass (T1548.002), the attacker writes a malicious registry key, such as modifying HKCU\Software\Classes\ms-settings\shell\open\command, that will be executed when an auto-elevating process like fodhelper.exe launches. The registry write happens under the user's own hive (no admin required), while the execution inherits the elevated token.
3. Trigger the elevation: The attacker executes the auto-elevating process. Windows silently elevates it, and the malicious registry payload executes in a high-integrity context, without any UAC prompt appearing to the user.
4. Establish high-privilege persistence: With a high-integrity token, the attacker installs a malicious service, disables security tools, or extracts credentials from LSASS. The UAC bypass is a stepping stone, not the end goal. Common next steps include creating or modifying system processes (T1543) and using the resulting access for lateral movement (TA0008).

Detection Indicators for T1548

Detection for T1548 requires monitoring both registry activity (for UAC bypass) and process integrity levels (for the resulting elevated execution). Because no vulnerability is exploited, signature-based detection is ineffective and behavioral analysis is the only reliable approach.

Pre-bypass Indicators

• Registry key writes to auto-elevation paths: Modifications to HKCU\Software\Classes sub-keys, particularly ms-settings, mscfile, or Folder\shell\open\command, from a medium-integrity process are a strong pre-execution indicator of T1548.002. Sysmon Event ID 13 (RegistryEvent: value set) captures these with full key and value data.
• Privilege enumeration tools: Commands like whoami /groups, whoami /priv, or tool executions (WinPEAS, SharpHound, UACME) in the minutes preceding the UAC bypass indicate active pre-exploitation enumeration.

Execution Indicators (UAC Bypass — T1548.002)

The most reliable T1548.002 indicator is an auto-elevating Windows process spawning an unexpected child process. Log360 monitors process creation events (Event ID 4688 and Sysmon Event ID 1) to detect this pattern:

• fodhelper.exe, eventvwr.exe, or sdclt.exe spawning cmd.exe, PowerShell, or unusual executables: These processes should never spawn interactive command interpreters during normal operation. Any such parent-child relationship is suspicious.
• High-integrity process without consent.exe in the execution chain: Legitimate UAC elevation always invokes consent.exe (UAC dialog host). A high-integrity process with a medium-integrity parent and no consent.exe in the chain indicates UAC was bypassed.
• Process token elevation type — full (3) without prompt: Event ID 4688 records TokenElevationType. A value of %%1937 (type 3: full elevation) for a process whose parent shows %%1938 (type 2: limited) without an intervening consent.exe is a high-fidelity UAC bypass indicator.

Cloud Indicators (T1548.005)

• Unexpected STS AssumeRole calls: AWS CloudTrail records every AssumeRole API call. Calls from principals that don't normally assume the target role, or role assumptions to administrator-equivalent policies from low-privilege accounts, are key T1548.005 indicators.
• Azure PIM role activation from unusual locations: Azure Privileged Identity Management (PIM) role activations from unfamiliar geographies, IP addresses, or at unusual hours indicate potential T1548.005 abuse.

Log360 Detection Rules for T1548

ManageEngine Log360 covers T1548 through pre-built behavioral rules for Windows UAC bypass patterns, registry manipulation, cloud IAM abuse, and Linux privilege escalation. The following rules are mapped to T1548 in Log360's threat detection engine:

Investigation Steps

When Log360 fires a T1548-related alert, follow this investigation sequence to confirm the bypass, identify the payload, and determine the full blast radius:

1. Examine the auto-elevated process and its child: In the Log360 process investigation view, identify the auto-elevating parent (fodhelper.exe, eventvwr.exe, sdclt.exe) and the child process it spawned. Note the child process name, command-line arguments, and working directory which reveals the attacker's payload or secondary tool.
2. Review registry modifications preceding the alert: Search Sysmon Event ID 13 logs for HKCU\Software\Classes writes in the 5-minute window before the alert timestamp. The registry value written will contain the malicious command or payload path. This is the staging step, identifying it reveals the attack payload even if the subsequent process was obfuscated.
3. Determine what the elevated process executed: Trace all child processes of the high-integrity session. Common next steps after UAC bypass include: credential dumping (LSASS access), service installation (Event ID 7045), PowerShell with encoded commands, or download of additional payloads. Each of these generates its own alert in Log360.
4. Check for persistence mechanisms installed post-bypass: Review Event ID 7045 (new service) and 4698 (scheduled task created) in the 10-minute window after the UAC bypass. Attackers typically establish persistence within minutes of achieving high-integrity access.
5. Assess lateral movement risk: With a high-integrity token, attackers can dump credentials (LSASS) and use them for pass-the-hash (T1550) or remote services abuse (T1021). Check for outbound SMB, RDP, or WinRM connections from the affected host in the post-bypass window.
6. For cloud alerts: Review the full IAM role assumption chain in CloudTrail. Identify who initiated the AssumeRole call, from which principal, to which target role, and what API calls were made with the assumed credentials. Check for data access events (S3 GetObject, Secrets Manager GetSecretValue) that indicate the elevated access was used for exfiltration.

Response Playbook

• Isolate the affected host: Remove the system from the network to prevent lateral movement from the high-integrity session. UAC bypass gives attackers the equivalent of local admin and so credential dumping and lateral movement can happen within seconds.
• Remove the malicious registry key: Delete the UAC bypass registry entry (e.g., HKCU\Software\Classes\ms-settings\shell\open\command) and any associated keys under HKCU\Software\Classes. This removes the bypass mechanism and prevents re-exploitation if the host is reconnected.
• Terminate malicious processes and remove persistence: Stop any processes launched via the bypass. Remove malicious services (Event ID 7045), scheduled tasks (Event ID 4698), or startup entries created in the post-bypass window.
• Reset credentials on the affected host: With high-integrity access, LSASS credential extraction is trivial. Rotate local administrator passwords (LAPS), service account passwords, and any credentials for accounts that logged onto the host interactively.
• Enable UAC to the highest setting: Ensure UAC is configured to "Always notify" (the maximum setting). Many UAC bypass techniques work only when UAC is set to "Notify only when apps try to make changes", the default. The highest setting forces a prompt even for Windows binaries.
• For cloud incidents: Revoke the temporary credentials obtained via the abused role assumption. Review and tighten the IAM trust policy on the assumed role. Enable AWS STS session policies with condition keys limiting the source IP range. Review any resource access made with the elevated credentials for data exfiltration indicators.
• Threat hunt for lateral movement: Search Log360 for RDP (Event ID 4624, logon type 10), SMB admin share access, and WinRM sessions originating from the affected host after the bypass timestamp. Use Log360 UEBA to identify any accounts showing anomalous behavior following the incident.

Need to explore ManageEngine Log360? Schedule a personalized demo

Frequently Asked Questions